Singapore Reports $11.8M Loss from LinkedIn Crypto Job Scams

Singapore’s authorities are sounding the alarm on a scam operation that has siphoned roughly $11.8 million from cryptocurrency firms, with attackers posing as recruiters for legitimate companies. A joint alert from the Singapore Police Force and the Cyber Security Agency of Singapore details how these scammers lured victims through fake hiring processes, ultimately planting malware that granted them access to corporate code repositories.

The Anatomy of the Scam

Fake recruiters typically reach out to employees at crypto-related firms via LinkedIn. Victims are invited to a video interview, during which the interviewer never turns on their camera. Communication occurs through spoofed email domains, and candidates are directed to a fraudulent coding challenge platform. The moment a victim downloads the assessment files, malware installs itself on their machine, harvesting session tokens that allow attackers to bypass multi-factor authentication.

Implications of the Attack

With valid session tokens, attackers accessed Bitbucket accounts, modifying software to bypass transaction limits and facilitate unauthorized transfers. This method of targeting employees rather than individual retail holders reflects a more efficient approach, leading to significant financial losses.

Recommendations for Safety

• Verify job offers through official company channels.
• Avoid downloading files from unknown sources.
• Scrutinize session management policies and ensure token lifetimes are short.
• Implement security protocols for hiring processes to verify interviewers' identities.

The reported losses likely understate the full scope, suggesting that the campaign is ongoing and that more firms may be at risk.